github: enable Dependabot action updates

Why:
Pinned GitHub Actions improve workflow integrity, but they should not freeze
CI on old action commits indefinitely. Automated update pull requests give us a
reviewable path for security and maintenance updates after pinning.

Impact:
Dependabot will open weekly GitHub Actions update pull requests.

Before/After:
Before, action updates were manual; after, Dependabot proposes them weekly.

Technical Overview:
Add a Dependabot v2 configuration for the `github-actions` ecosystem at the
repository root. Limit open update pull requests to keep review load bounded.
Apply the existing CI and cleanup labels and use a short CI commit-message
prefix so update PRs are easy to identify in the history.

With the help of AI-Agents: Harvey

.github/dependabot.yml

@@ -0,0 +1,17 @@
+---
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    labels:
+      - "CI"
+      - "cleanup"
+    commit-message:
+      prefix: "ci"